Privacy notice
This notice explains how personal data is processed when you visit the aerolim.com website, leave a demo or support request, or use the Aerolim software. It is prepared under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and, for users in the European Union and European Economic Area, Articles 13 and 14 of the General Data Protection Regulation (“GDPR”).
1. Who we are
Tuna Coşkun – AEROLIM (sole proprietorship)
Cevizli Mah. Zuhal Cad. A Blok No: 46 İç Kapı No: 50, Maltepe / Istanbul, Türkiye
Phone: +90 538 316 87 17
Email: info@aerolim.com
2. What data we process, why, and on what legal basis
| Whose data | Data | Purpose | Legal basis |
|---|---|---|---|
| People who leave a demo or support request | Name, company name, email, phone, type of operation, fleet size, message; request number | Answering the request, planning a demo, preparing an offer, sending a confirmation email | Steps prior to entering into a contract (KVKK Art. 5/2(c); GDPR Art. 6(1)(b)); legitimate interest (KVKK Art. 5/2(f); GDPR Art. 6(1)(f)) |
| Website visitors | IP address, browser and device information, time of request (server logs) | Running the website securely, preventing abuse and excessive requests | Legitimate interest; legal obligation (Turkish Law No. 5651) |
| Customer contacts and user accounts | Name, email, role, sign-in records, activity records | Opening accounts, performing the contract, invoicing, security and audit trail | Performance of the contract; legal obligation (tax law); legitimate interest |
Data that our customers enter into the application
Aircraft operators enter data about their flight crew, cabin crew and passengers (duties, flights, documents, training, medical validity dates, passenger lists and similar) into the Aerolim application (limit.aerolim.com) themselves. The operator is the controller of this data. AEROLIM acts only as a processor (GDPR Art. 28) on the operator’s instructions and under the data processing terms of our terms of service. Informing these people is the operator’s obligation; please address your questions first to the operator you work or fly with. Customers in the EU/EEA who need a separate data processing agreement can contact us at info@aerolim.com.
3. How data is collected
Data is collected electronically through the forms on the website, when you sign in to and use the application, automatically through server logs, and from our phone and email correspondence with you.
4. Who receives the data
Personal data is not sold and is not shared for advertising. To provide the service, it is shared only to the extent necessary with the service providers (sub-processors) below. Services marked “only if turned on” are off by default; no data goes to these providers unless the customer turns the feature on. Customers are informed of a new sub-processor at least 30 days in advance.
| Provider | Service and data | Location | Status |
|---|---|---|---|
| Render Services, Inc. | Hosting of the website, application and database, and database backups; all application data | Frankfurt, Germany (company in the USA) | Active |
| Resend, Inc. | Sending notification, password reset, invitation and confirmation emails; recipient name, email address and email content | USA | Active |
| Hostinger International Ltd. | Domain name (DNS) service; no personal data is processed, only domain name queries are answered | Company in Cyprus (EU); DNS servers in several countries | Active |
| Cloudflare, Inc. (R2) | Storage of EFB flight document files | Jurisdiction of the storage bucket (company in the USA) | Only if this storage is configured |
| Anthropic, PBC | (1) Optional automatic document reading: if the company administrator turns it on, the full content of bulk-uploaded training and medical documents is read (including names, numbers, medical class and limitations). (2) Review of possible sanctions matches: if the company administrator turns it on, the person’s name, date of birth and nationality are sent for a possible match; no document number is sent for sanctions screening. | USA | Only if turned on by the company administrator; off by default |
| Netgsm İletişim ve Bilgi Teknolojileri A.Ş. | Sign-in verification codes and flight information by SMS; phone number and message text | Türkiye | Only if SMS is turned on |
| Meta Platforms (WhatsApp Business Platform) | Sign-in verification codes and flight information by WhatsApp; phone number and message text | EU and USA | Only if WhatsApp is turned on |
| Apple Inc. (APNs) | Push notifications to the Aerolim EFB iOS app; device notification token and notification text | USA | Only if notifications are enabled in the iOS app |
| OpenStreetMap Foundation | Map tiles for the route map in the application; your browser’s IP address and browser information go directly to this service | United Kingdom and other countries | When the route map is opened |
The website and the application serve their fonts from our own server; no connection is made to Google or any other font service. When data is fetched from public sources such as weather, NOTAM, ADS-B and sanctions lists, no personal data is sent to them (only items such as aerodrome codes or aircraft registrations are queried).
Transfers abroad are made in line with Article 9 of the KVKK, using the standard contracts announced by the Turkish Personal Data Protection Authority where required, and with the necessary technical and organisational measures. Data may also be disclosed to legally authorised public bodies (for example the Turkish Directorate General of Civil Aviation, the tax administration or the courts) on request and to the extent required by law.
5. Retention
- Demo and support requests: 2 years after the request is closed; for the duration of the contract if you become a customer.
- Server and access logs: 1 year.
- Customer account and application data: for the duration of the contract; at the end of the contract it is exported to the operator and deleted within 90 days. Keeping the records required by aviation regulations is the operator’s obligation.
- Invoices and accounting records: the periods set by tax law (10 years).
Data whose retention period has ended is deleted, destroyed or anonymised.
6. Cookies and browser storage
aerolim.com uses no advertising or tracking cookies and does no visitor analytics. On the website only your chosen language is kept in your browser’s local storage (localStorage). In the application, the session key that keeps you signed in and preferences such as theme and language are kept in your browser’s local storage; they are required for the application to work, and the session key is deleted when you sign out.
7. Your rights
Under Article 11 of the KVKK, and for people in the EU/EEA under Articles 15 to 22 of the GDPR, you have the right to know whether your personal data is processed and to request information about it; to learn the purpose of processing and whether it is used accordingly; to know the third parties it is transferred to; to have incomplete or incorrect data corrected; to have data erased or destroyed; to have these actions notified to the recipients; to object to a result against you that arises solely from automated processing; to restrict processing and to data portability where the GDPR applies; and to claim compensation for damage caused by unlawful processing.
For data that an operator entered into the application, please send your request to that operator; we will help the operator answer it. For other requests, write to the address above with information that identifies you. Requests are answered free of charge within 30 days at the latest. You also have the right to complain to the Turkish Personal Data Protection Authority (KVKK), or, in the EU/EEA, to the data protection authority of your country.
8. Security
Connections are encrypted with TLS; passwords are stored one-way (bcrypt); two-step verification is mandatory for administrators; passport and ID numbers, sanctions screening results and uploaded files are additionally encrypted in the database; each operator’s data is kept logically separate; screen-level permissions are enforced on the server; and changes and security events are recorded in the audit log. Details: Security. To report a vulnerability: info@aerolim.com (security.txt).
9. Changes
We update this notice when necessary; the current version is always on this page and the date above changes.